Data::Graph::Shared CVE-2026-64615

Requires local, authenticated (low-privilege) access to the host running Data::Graph::Shared - the CVSS vector AV:L/PR:L confirms this. The mmap backing file must be created in a directory writable by other local users, such as /tmp or /dev/shm (the natural location for shared IPC segments). The simpler read-based attack requires only that the world-readable 0644 file exists and the attacker can read it - no race condition required. The O_EXCL/symlink attack additionally requires that the attacker can write to the target directory before the victim process creates the file. Exploitation is limited to the local system - no network vector exists. The sensitive data disclosed is bounded to what the application stores in shared graph structures, which may be non-sensitive coordination data.

The CVSS 3.1 base score of 3.3 (Low) is well-calibrated for this issue: AV:L requires local system access, PR:L requires a standard (non-root) user account, and C:L reflects partial IPC data disclosure rather than full system compromise. The EPSS score of 0.16% at the 6th percentile confirms this is a theoretical concern with negligible observed exploitation interest in the wild. There is no CISA KEV listing and no known public exploit code. The two attack surfaces are meaningfully distinct in difficulty: passively reading the world-readable 0644 file requires no timing or race condition (AC:L), whereas the O_EXCL/O_NOFOLLOW symlink attack involves a pre-creation race that depends on filesystem layout and process timing. The simpler read-based attack drives the AC:L assessment. Real-world impact is bounded by the sensitivity of data placed in the shared graph structures - if only non-sensitive inter-process coordination data is stored, practical harm is minimal. This is a genuine low-severity fix to adopt at the next patching cycle but not an emergency.

A local user on a multi-tenant Linux system where Data::Graph::Shared is in use monitors /tmp or /dev/shm for the mmap backing file path used by a target process - or predicts it - and either reads the 0644 file directly to extract IPC payload data, or pre-plants a symlink before the target process starts. Because O_EXCL is absent, the target process silently opens the attacker-controlled path, and the attacker can read or observe the contents of the shared graph segment. No public exploit code is known.